Kids, Privacy, Free Speech & the Internet: Finding the Right Balance

7/27/2019 Kids, Privacy, Free Speech & the Internet: Finding the Right Balance

1/15


2/15

1

INTRODUCTION

In the field of Internet policy, 2011 has been the year of privacy. Congress has introduced sixbills related to online privacy, 1 and the Obama administration released two major reportsrecommending greater federal oversight of online markets. 2 The Federal Trade Commission(FTC) appears poised to step up regulatory activity on this front. 3 State-level activity is alsopercolating, led by California, which floated two major bills recently. 4

These efforts would expand regulatory oversight of online activities in various ways. Somemeasures would institute Fair Information Practice Principles (FIPPS), governing the collectionand use of personal information online. 5 Others would limit some types of data collection, bancertain data or advertising practices, or create new mechanisms to help consumers block onlinead-targeting techniques. Another measure would mandate websites adopt a so-called InternetEraser Bu

sites and services.

Concerns about c are an important part of this debate. The KPrivacy Protection Act of 1998 (COPPA) already mandates certain online-privacy protections forchildren under the age of 13. The goal of COPPA was to enhance parent involvement in theirchildren The FTC iscurrently considering an expansion of COPPA, 6 and lawmakers in the House of Representativesintroduced legislation that would expand COPPA and apply additional FIPPS regulations toteenagers. 7 Some state-based measures also propose expanding COPPA. 8

1


3/15


4/15

3

difficult to enforce such a restriction. This is one of the factors leading policy makers andregulatory advocates to push for expanding COPPA and 13

This year, lawmakers in the State of California introduced SB 242 The Social NetworkingPrivacy Act which aims to make social networking sites private by default. It would also forcesites to take down personal information upon request of users or parents of users under theage of 18 years. The bill stalled in the California Senate in late May, but it could serve as amodel for other states in coming months. 14

At the federal level, Reps. Edward Markey (D-Mass.) and Joe Barton (R-Texas) recently releasedthe Do Not Track Kids Act of 2011 d would expand COPPA and adopt severalother new regulations in an attempt ine. It would apply FIPPSregulations to teenagers via a Digital Marketing Bill of Rights for Teens and also impose limitson collection of geolocation information from both children and teens. The bill would alsomandate sites create Eraser Buttons, a concept modeled loosely on a similar ideabeing considered in the European Union, a so- . Specifically,the bil mechanisms that permit users of the website, service, or application of the operator to erase orotherwise eliminate content that is publicly available through the website, service, or In essence,eraser buttons would help minors wipe out embarrassing facts they have placed online butlater come to regret. 15

PROBLEMS WITH COPPA AND ITS EXPANSION

The influential child safety group Common Sense Media (CSM) floated some of the regulatoryproposals discussed above in a report released December 2010. 16 It is understandable whysome policymakers and child-safety advocates like CSM would favor such steps. They fear thatthere is too much information about kids online today or that kids are voluntarily placing far toomuch personal information online that could come back to haunt them in the future.

These are valid concerns, but there are both practical and principled concerns with theregulatory approach embodied in the Markey- E d W ^ E D W z oungest Users Washington Post , June 10, 2011, http://www.washingtonpost.com/business/technology/lawmakers-advocatespush-social-networks-for-more-protection-of-youngest-users/2011/05/27/AG7ByiOH_story.html.14 Patrick McGreevy Kne Privacy Bill Fails to Pass California Senate Los Angeles Times , May 28, 2011,http://www.latimes.com/news/local/la-me-social-networking-20110528,0,5345331.story.15 > Z K D , Technology Liberation Front , November 16, 2010,http://techliberation.com/2010/11/16/europe-reimagines-orwells-memory-hole.16W K


5/15

4

A. COPPA I What It Says It Is

As written, COPPA is not the clearest of rules. First, all the terms in the COPPA law and rule areopen to interpretation and challenged by ongoing technological change. Furthermore, even theFTC has its doubts about the effectivene KWW d &d KWW / 17 developments, and are not currently available as a substitute for other screening 18 This makes it clear that the FTC does not regard the methods it has adopted forobtaining parental consent under COPPA as the equivalent of strict age verification.

The FTC understands that no age-verification technology is foolproof. Even credit cards, themost common method used to verify parental consent, cannot always be trusted to verify aparent-child relationship. Although credit cards may seem the most robust tool for verifyingparental consent essentially, age verifying the parent federal courts have found, in rejectingthe constitutionality of the Child Online Protection Act (COPA) used to verify age because minors under 17 have access to credit cards, debit cards, and D -card issuers usually will not issue ther ways in which a minor may obtain and use 19

B. Threat of Mandatory Age Verification for All Users

First, it is unclear how an expanded COPPA regulatory regime would work without requiringmandatory online age verification of all Internet users, which would raise serious constitutionalissues. To verify the relationship between a parent and a minor when a take-down request isreceived, a more sophisticated identity-authentication scheme is required. A previous effort to

age-verify users, the Child Online Protection Act (COPA), was found to violate the FirstAmendment and also to raise different privacy concerns. 20 Federal courts found that there is age-verification services or products available on the market to owners of websites that actually reliably establish or verify the age of Internet users. Nor is there evidenceof such services or products that can effectively prevent access to w 21 InJanuary 2009, after a decade-long court battle over the constitutionality of COPA, the U.S.

17 Federal Trade Commission, / K W W Z ,February 2007, 28, www.ftc.gov/reports/coppa/07COPPA_Report_to_Congress.pdf.18 Ibid., 12.19 Gonzales , 478 F. Supp. 2d at 801. COPA would have prohibited the online dissemination of material deemedharmful to minors under the age of 17 for commercial purposes, 47 U.S.C. 231(a)(1), subject to a safe harbor for ; account, adult access code, or adult personal identification number; (B) by accepting a digital certificate thatverifies age; or (C) by any other reasonable measures that are feasible und h ^ 231(c)(1).20 d KW Technology Liberation Front , January 21, 2009,http://techliberation.com/2009/01/21/closing-the-book-on-copa.21 ACLU v. Gonzales , 478 F. Supp. 2d 775, 806 (E.D. Pa. 2007).


6/15

5

Supreme Court rejected the federal likely dead.

There are many other concerns about age-verification mandates. 22A 2008 report produced bythe Internet Safety Technical Task Force (ISTTF), a Harvard-based blue ribbon task forceassembled by state Attorneys General to study this issue, found that:

Age verification and identity authentication technologies are appealing inconcept but challenged in terms of effectiveness. Any system that relies onremote verification of information has potential for inaccuracies. For example,on the user side, it is never certain that the person attempting to verify anidentity is using their own actual identity or someone system thatrelies on public records has a better likelihood of accurately verifying an adultthan a minor due to extant records. Any system that focuses on third-party in-person verification would require significant political backing and socialacceptance. Additionally, any central repository of this type of personalinformation would raise significant privacy concerns and security issues. 23

Internet security expert Bruce Schneier has similarly outlined the dangers of going down thispath:

d t work. Any design of the Internet must allow foranonymity. Universal identification is impossible. Even attribution knowingwho is responsible for particular Internet packets is impossible. Attempting tobuild such a system is futile, and will only give criminals and hackers new ways tohide.

Implementing an Internet without anonymity is very difficult, and causes its ownproblems. In order to have perfect attribution, we'd need agencies real-worldorganizations to provide Internet identity credentials based on otheridentification systems: passports, national identity cards, driver's licenses,whatever. Sloppier identification systems, based on things such as credit cards,are simply too easy to subvert. We have nothing that comes close to this globalidentification infrastructure. Moreover, centralizing information like this actuallyhurts security because it makes identity theft that much more profitable a crime.

22 Adam Thierer, Social Networking and Age Verification: Many Hard Questions; No Easy Solutions , Progress onPoint No. 14.5, The Progress & Freedom Foundation, March 2007; Adam Thierer, Statement Regarding the Internet ^ d d & & Z ' , The Progress & Freedom Foundation, January14, 2008, www.pff.org/issues-pubs/other/090114ISTTFthiererclosingstatement.pdf : ^ OnlineChild ^ ^ W d The Guardian , spring 2007,www.jschmidt.org/AgeVerification/Gardian_JSchmidt.pdf.23 Internet Safety Technical Task Force, Enhancing Child Safety & Online Technologies: Final Report of the Internet Safety Technical Task Force to the Multi-State Working Group on Social Networking of State Attorneys General of the United States , December 31, 2008, 10, http://cyber.law.harvard.edu/pubrelease/isttf.


7/15


8/15


9/15

8

B. Security Issues

The Eraser Button concept also raises security concerns. Is there an ironclad way for sites to request? Mandating the creation of eraser buttons would, ironically, require an identity verification system that would be used forpotentially even more sophisticated online than we see at work today.

An Eraser Button could open dangerous backdoor vulnerabilities to hackers or others withmalicious intentions. Teens often share a great deal of personal information (includingpasswords) with friends and family members, which could lead to a disastrous scenario if othersrequest deletion of information that should not be theirs to control.

C. Complexities Associated with Shared Content

Shared content also presents problems for the Eraser Button concept. Many photographs, blogposts, or social networking entries include multiple people and are copied and reposted onmultiple sites (and often archived). Facebook says users submit around 650,000 comments onthe 100-million pieces of content served up every minute on its site. 32 If one person decides tohit their Eraser Button on a site, would others have to delete content if it is shared? Mustdigital-archiving and data-storage services all comply with the same deletion requests a sitereceives? What about news sites or blogs that may have clipped some of the data?

There are other thorny enforcement issues to take into account. Who actually owns the datacollected by online sites and services? Websites or data collection services might use personalinformation uploaded by individuals to run website analytics, serve up advertising to support h who technically ownswhat can be complicated, especially in light of the sheer volume of information uploaded everyday.

D.

Conflict with 47 U.S.C. 230 ; Section 230 The Eraser Button concept could also lead to a flood of bogus takedown requests. Every bloggercould conceivably be asked at any time to delete any comment on any post ever written if someone does not like the commentary written online about them. If that occurs, an EraserButton mandate would be in conflict with h ^ ^ .

Section 230 was part of the Telecommunications Act of 1996. It third parties. 33 Importantly, it also shielded them from liability if they took steps to restrict 34 This means online

32 ^ & & http://www.facebook.com/note.php?note_id=496077348919.33 E i 47 U.S.C. Sec. 230(c)(1).34 E ter service shall be held liable on account of any action voluntarilytaken in good faith to restrict access to or availability of material that the provider or user considers to be obscene,lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material isconstitutionally protected; or any action taken to enable or make available to information content providers or 47 U.S.C. Sec. 230(c)(2).


10/15

9

intermediaries have generous leeway to determine what content and commerce travels overtheir systems without the fear that they will be overwhelmed by lawsuits if other parties objectto some of that content.

Online speech and commerce would likely be severely stifled if not for the broad immunitiesgranted by Section 230. For example, user- t sites and services would have been less likely to develop as rapidly or robustly as they have. 35

The Eraser Button concept would contradict the spirit of Section 230 and lead to confusionabout what types of content must be taken down versus what could remain online without fearof liability. If the threat of liability encourages site administrators to begin removing massiveamounts of content or blocking communications and social networking functionality, thechilling effect on the free exchange of views/information would likely be quite profound.

CONSTRUCTIVE ALTERNATIVES TO REGULATION

S E d


11/15

10

information they collect especially if they primarily serve young audiences. Most widelytrafficked social networking sites and search engines already offer a variety of privacy controls.And accounts can always be deleted.

Many excellent online safety and privacy-enhancing tools already exist for parents and teens tobetter safeguard their online privacy. 39 A host of tools are available to block or limit varioustypes of data collection, and every major web browser has cookie-control tools to help usersmanage data collection. Consider some of the privacy-enhancing tools and systems alreadyavailable on the market today:

x Ad preference manager ' 40 Microsoft, 41 and Yahoo! 42 all offer easy-to-use opt-out tools and educational web pagesthat clearly explain to consumers how digital advertising works. 43 Meanwhile,DuckDuckGo offers an alternative search experience that blocks data collectionaltogether. 44

x D s, which allows users to

d available as a menu D / ; /W ),45 ' ; / ,46 D & ; W ).47 Firefoxalso has many add-ons available that provide the functional equivalent to stealth modeor offer additional functionality. 48 t K Z CNET News.com You can set Mozilla Firefox, Microsoft Internet Explorer, and GoogleChrome to clear out and block the cookies most online ad networks and other Webtrackers rely on to 49

x Users can also take advantage of many supplemental tools and add-ons to betterprotect their privacy online by managing cookies, blocking web scripts, and so on. Like

the marketplace for parental-control technologies, a remarkable amount of innovationcontinues in the market for privacy-empowerment tools, so much so that it is impossible

39Adam Thierer, Public Interest Comment on Protecting Consumer Privacy in an Era of Rapid Chang e, MercatusCenter at George Mason University, February 18, 2011, 24-28,http://mercatus.org/publication/public-interest-comment-protecting-consumer-privacy-era-rapid-change.40 http://www.google.com/ads/preferences.41 http://choice.live.com/Default.aspx and https://choice.live.com/AdvertisementChoice/Default.aspx.42 http://info.yahoo.com/privacy/us/yahoo/opt_out/targeting/details.html.43 Microsoft Advertising AdCenter: http://advertising.microsoft.com/home?s_cid=us_msn_footer; Yahoo! PrivacyCenter: http://info.yahoo.com/privacy/us/yahoo; Google Privacy Center: http://www.google.com/privacy/ads.44http://duckduckgo.com/privacy.html. See also Jennifer Valentino-DeVries Can Search Engines Compete onPrivacy? Wall Street Journal , January 25, 2011, http://blogs.wsj.com/digits/2011/01/25/can-search-engines-compete-on-privacy.45 http://www.microsoft.com/windows/internet-explorer/features/safer.aspx?tab=6.46 http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95464.47 http://support.mozilla.com/en-US/kb/Private%20Browsing.48 https://addons.mozilla.org/en-US/firefox/tag/incognito.49 K Z E d & / ' CNetNews.com , December 7, 2010,http://news.cnet.com/8301-13880_3-20024815-68.html.
http://blogs.wsj.com/digits/2011/01/25/can-search-engines-http://blogs.wsj.com/digits/2011/01/25/can-search-engines-


12/15

11

to document everything. However, some of the more notable ones include: Ghostery, 50 NoScript, 51 Cookie Monster, 52 Better Privacy, 53 Track Me Not, 54 and the TargetedAdvertising Cookie Opt- K d K for Firefox; 55 No More Cookies for InternetExplorer; 56 Disconnect for Chrome; 57 AdSweep for Chrome and Opera; 58 CCleaner forPCs;59 and Flush for Mac. 60

x New empowerment solutions are constantly turning up. 61 / - ' online-reputation management tool that allows users to get regular reports about whatothers are saying about them online. 62 Meanwhile, for $4 to $8 per month,Z DW information fromvarious websites or data-collection services. 63

x Adblock Plus, which lets users block advertising on most websites, is the mostdownloaded add-on for both the Firefox and Chrome web browsers. 64 As of June 2011,roughly 125 million people (roughly 86,000 per day) had downloaded the Adblock Plusadd-on for the Firefox web browser. 65 Incidentally, both Adblock Plus and NoScript, thethird most popular download on Firefox, support the Do Not Track protocol. 66

x Finally, pressured by the FTC and privacy advocates, all three of the major browser-providers Microsoft, 67 Google, 68 and Mozilla 69 have now agreed to include some

50 https://addons.mozilla.org/en-US/firefox/addon/ghostery.51 https://addons.mozilla.org/en-US/firefox/addon/noscript.52 https://addons.mozilla.org/en-US/firefox/addon/cookie-monster.53 https://addons.mozilla.org/en-US/firefox/addon/betterprivacy.54 https://addons.mozilla.org/en-US/firefox/addon/trackmenot.55 There are multiple versions of the TACO add-on available for Firefox web browser.56

http://download.cnet.com/No-More-Cookies/3000-2144_4-10449885.html.57 http://www.disconnectere.com.58 https://addons.opera.com/addons/extensions/details/adsweep/2.0.3-3/?display=en.59 http://www.piriform.com/ccleaner.60 http://www.macupdate.com/app/mac/32994/flush.61 David Gorodyansky, t W , D d d d The Huffington Post ,December 30, 2010,http://www.huffingtonpost.com/david-gorodyansky/web-privacy-consumers hav_b_799881.html.62 ^


13/15

12

variant of a Do Not Track mechanism or an opt-out registry in their browsers tocomplement the cookie controls they already offered. These developments build onindustry- E / ^ -regulatoryW K 70 to make opting-out on targetedadvertising simpler. A collaboration of the leading trade associations in the field

announced that effort last Fall. They include: American Association of AdvertisingAgencies, American Advertising Federation, Association of National Advertisers, BetterBusiness Bureau, Digital Marketing Association, Interactive Advertising Bureau, andNetwork Advertising Initiative. 71 d K / ed advertising and gives consumers an easy-to-useopt-out option. It was accompanied by an educational initiative, www.AboutAds.info,which offers consumers information about online advertising. 72 The independentCouncil of Better Business Bureaus will enforce compliance with the system.

Empowerment efforts such as these have the added advantage of being more flexible thangovernment regulation, which tends to lock-in sub-optimal policies and stifle ongoing

innovation.What these developments illustrate is a well-functioning marketplace that is evolving to offerconsumers greater control over their privacy without upending online markets or destroyingthe quality of the browsing experience. It would be difficult exists when such a robust marketplace of empowerment tools exists to serve the needs of privacy-sensitive web surfers.

Just as most families leave the vast majority of parental control technologies untapped, manyhouseholds will never take advantage of these privacy-enhancing empowerment tools. 73 Thatfact does not serves proof of What matters is that the tools exist for those who wish to use them, not the actualuptake/usage of those tools.

68 Sean Harvey and Rajas Moonka


14/15

13

REGULATION IS NOT COSTLESS

This Educate and Empower approach also makes sense because of the cost associated withregulation. The vast majority of online sites and services are free of charge to the consumer.This did not happen by magic advertising and data collection made it possible. 74New privacyrules could result in online pay walls, subscriptions, micropayment schemes, or tiered services. 75 Web developers might have no choice but to raise prices to cover costs or cut back service. 76 Regulation could also destroy opportunities for new or smaller website operators to break intothe market and offer competing services and innovations, thus contributing to consolidation of online content and services by erecting barriers to entry.

The overall health of modern media marketplace and the digital economy and the aggregateamount of information and speech that can be produced or supported by those sectors isfundamentally tied up with the question of whether policymakers allow the online advertisingmarketplace to evolve in an efficient, dynamic fashion. 77A recent study by Avi Goldfarb andCatherine Tucker h W 2002], advertising effectiveness decreased on average by around 65 percent in Europe relativeto the rest of t 78 d may change the number and types of businesses sustained by the advertising-supporting/ Z canaffect the global competitiveness of online firms.

Targeted forms of online advertising could improve this effectiveness. A March 2010 study ond s d , E Advertising Initiative, demonstrates how this could be the case. 79 Beales, the former director of

74 d h ^ Mercatus on Policy 86(Arlington, VA: Mercatus Center at George Mason University, January 2011),

http://mercatus.org/publication/unappreciated-benefits-advertising-and-commercial-speech.75 Daniel D. Castro, Do-Not-Track > / E the Right Time d Energy and Commerce Subcommittee on Commerce, Trade, and Consumer Protection, December 2, 2010,http://democrats.energycommerce.house.gov/documents/20101202/Castro.Testimony.12.02.2010.pdf; LaurenWeinstein -Not-d t > t April 30, 2011,http://lauren.vortex.com/archive/000848.html; Adam Thierer, Public Interest Comment on Protecting Consumer Privacy in an Era of Rapid Chang e, Mercatus Center at George Mason University, February 18,2011, 12-14, http://mercatus.org/publication/public-interest-comment-protecting-consumer-privacy-era-rapidchange.76 d W d Forbes.com , April 4, 2011,http://www.forbes.com/2011/04/02/privacy-tax-social-networking-advertising-opinions-contributors-adam-thierer.html.77 Larry Downes, The Laws of Disruption: Harnessing the New Forces that Govern Life and Business in the Digital

Age (New York: Basic Books, 2009), 83-84. Much of the valuable information content available on the Internet,and so many of the useful services we use every day, is free not because of some utopian dream of inventors or

even because of the remarkably low transaction costs of the digital economy. The content is free because the costsof the services blogs, stock quotes, even home movies posted on YouTube are underwritten by advertisers. If rvices some other way

78 Avi Goldfarb and Catherine Tucker, W Z K Management Science 1,January 2011, 57-71, http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1600259.79 Howard Beales, d s d Network Advertising Initiative, March 2010,www.networkadvertising.org/pdfs/Beales_NAI_Study.pdf.
http://mercatus.org/publication/public-interest-comment-protecting-consumer-privacy-era-rapidhttp://mercatus.org/publication/public-interest-comment-protecting-consumer-privacy-era-rapid


15/15

Documents

Kids, Privacy, Free Speech & the Internet: Finding the Right Balance